Suspicious Google OAuth Token Request for Malicious Identity

Kaung Khant Ko@kaungkhantko

•updated Sep 8, 2026•1•0•2

Detects OAuth2 JWT bearer-grant token requests to Google's OAuth endpoint using the attacker-controlled service-account identity and Sheets API scope observed in the fake GlobalProtect campaign